Security audit
Security checks for vulnerabilities and agentic risk
This skill is not malicious, but it gives directive crypto and investment-timing guidance from speculative cycle claims without clear risk limits or financial-advice disclaimers.
Review this skill carefully before installing if you might act on crypto or investment advice. Treat its cycle scores, BTC sentiment mapping, and multi-year forecasts as speculative commentary only, not personalized financial advice or a basis for trading decisions. The external BTC sentiment fetch is disclosed and appears narrow, but the skill should not send private user context to that API.
This section gives concrete portfolio/trading recommendations such as lowering exposure to high-risk assets and focusing on specific sectors, without suitability checks, risk disclosures, or uncertainty framing. Because the skill is explicitly tied to crypto and investment timing, this can directly influence user asset allocation and losses.
The QCX section operationalizes a scoring model into action-oriented trading behavior like 'cash is king,' 'wait to buy the dip,' and 'actively participate,' while presenting computed outputs as actionable signals. Users could treat the score as authoritative despite the model being speculative and lacking validation, making financial harm likely.
The skill provides multi-year forecasts, warning years, and allocation suggestions as if they are dependable planning inputs, without disclosing that these are speculative predictions. Long-range financial forecasts can strongly influence user behavior, especially when paired with phrases like 'cash is king' or 'actively position,' increasing the chance of material losses.
The README presents the skill name, description, features, and usage instructions only in Chinese, and does not provide an opt-in or alternative language. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.
The skill positions itself around cycle-based economic prediction and investment decision support, but does not clearly warn users that the content is speculative, non-financial-advice, and may be inaccurate. In a trading/crypto context, users may rely on these claims to make real financial decisions, creating foreseeable harm from unsupported predictive guidance.
The skill instructs the agent to call an external API to retrieve BTC sentiment data, which creates an outbound data flow and dependency on third-party content. While the referenced API itself is not obviously malicious here, external transmission can expose user context or enable untrusted data to shape financial outputs if requests are not tightly controlled.
当用户发送 /qcx 时，自动获取当前 BTC 情绪指数：
调用 API：https://api.alternative.me/fng/
当前实时数据：
No suspicious patterns detected.